The Upbound Platform manages a fleet of Kubernetes control planes, Crossplane or otherwise. These skills teach a coding agent to query and change that fleet correctly — which mostly means stopping it from confidently reporting numbers that are wrong.
Agent Skills are instructions an agent loads when a task matches them.
Claude Code is the supported agent today.
/plugin marketplace add upbound/skills
/plugin install upbound@upbound
marketplace add registers the source; install adds the plugin. Once this lands in
Anthropic's plugin directory, /plugin install upbound@claude-plugins-official will be
enough on its own.
To try it without installing:
git clone https://github.com/upbound/skills upbound-skills
claude --plugin-dir upbound-skillsclaude plugin marketplace update upbound # refresh the source
claude plugin update upbound@upbound # then the plugin; restart to applyclaude plugin list shows the version you are on, and the version here is bumped on every
merge that touches skills/.
Worth doing rather than leaving to drift. A skill is instructions, so an out-of-date copy does not fail — it keeps confidently answering from whatever it last knew, including endpoints and field names that have since been corrected.
Not supported yet, though the skills carry no vendor-specific frontmatter, so copying
skills/upbound-hub/ into another agent's skills directory should load. Nothing here is
tested against another agent, and the scripts assume bash, curl, and jq.
Adding an agent means a manifest alongside .claude-plugin/; the layout is arranged so it
moves no files.
| Skill | Needs |
|---|---|
upbound-hub |
bash, curl, jq, shasum; kubectl only for writes |
| control-plane-project suite | the up CLI, python3 3.9+, and Docker or Podman for function builds; an Upbound account only for E2E runs and cloud dev control planes |
The control-plane-project suite is eight skills that work together:
control-plane-project-charter holds the shared rules and per-language references, and
author-composition, author-tests, author-configuration-package, verify-configuration,
e2e-test-configuration, plan-v2-migration, and execute-v2-migration reference it.
Loading a task skill does not load the charter: each one tells the agent to load it as well,
and agents often skip that step. Install them together; copying one of them on its own leaves
it without the charter.
To review a change, the Crossplane-specific checks are on one page:
review.md.
On first run the upbound-hub skill downloads a credential helper from storage.googleapis.com and
checks it against a published SHA-256. It asks once for your Hub API endpoint and saves it,
so there is nothing to set up in advance.
Install the plugin, then ask your agent an ordinary question:
How many resources are unhealthy across the fleet?
The agent runs setup itself — installing the credential helper, verifying its checksum, and signing you in. It asks once for your Hub API endpoint and remembers it.
Then it loads upbound-hub, queries the aggregation endpoint rather than paging 40,000
records, and answers with two denominators: how many resources exist, and how many actually
carry health conditions. Most do not, so a single percentage would be wrong. Without the
skill, agents report one anyway.
More questions it handles:
List the control planes and group them by phase.
What CRDs and XRDs do we have for AWS?
Show me the unhealthy resources in prod-1.
| Skill | What it is for |
|---|---|
author-composition |
Use this skill when the user asks to create, extend, modify, or debug a Crossplane composition function in a control-plane project — in any language (KCL, Python, TypeScript, Go, go-templating). |
author-configuration-package |
Use this skill when user requests to create, scaffold, modify, or extend a Crossplane configuration package. |
author-tests |
Use this skill when user requests to write, create, author, modify, refactor or plan refactoring of Crossplane configuration tests (composition tests or E2E tests) in a control-plane project - in any language (KCL, Python, YAML, Go, go-templating). |
control-plane-project-charter |
Shared rules and per-language references for the Upbound control-plane-project skills - agent behaviour, the test-first loop, what a v2 composed resource needs, the container boundary, what a green run proves, how to report, and the KCL, Python, TypeScript, Go, go-templating and YAML references. |
e2e-test-configuration |
Run Crossplane E2E tests (up test run --e2e) for a control-plane project, locally on kind (--local) or on an Upbound Space (Upbound Cloud). |
execute-v2-migration |
Use this skill when user requests to execute or implement a Crossplane v2 migration plan. |
plan-v2-migration |
Use this skill when user requests to migrate, upgrade, or plan migration to Crossplane v2. |
upbound-hub |
Query and mutate Upbound Hub, the central API for an Upbound Platform deployment, which gives one cross-fleet view of control planes, spaces, realms, types, packages, resources, identity providers, and the image catalog. |
verify-configuration |
Verify a Crossplane configuration package before committing - build it, run its composition tests and read the render, and optionally orchestrate its E2E tests or run the project on a development control plane ("verify the configuration", "validate the project", "is this ready to commit", "run the tests", "run the project", "deploy it", "spin it up", "try it on a control plane", "up project run", "dev control plane"). |
Each skill is a directory with a SKILL.md and, where it helps, references/ and
scripts/.
SKILL.md is loaded whenever the skill triggers, so it holds what is needed nearly every
time: what the thing is, how to set it up, and the mistakes worth avoiding. Longer material
lives in references/, which the agent reads only when it needs to. That keeps the
always-loaded cost small without losing depth.
Frontmatter is deliberately minimal: name and description, plus optional license and
references. CI rejects everything else — allowed-tools, model, and the rest — which is
what keeps the skills portable rather than merely claiming they are.
See CONTRIBUTING.md and the Code of Conduct.
make check, make lint, and make test cover most of CI.
Skill fixes are welcome and small ones are the most valuable: if an agent gave you bad advice, the fix is usually a paragraph.
Skills are instructions, and some ship shell scripts that run with your credentials. Read SECURITY.md before installing, and report vulnerabilities privately.